PT-2026-84643

Name of the Vulnerable Software and Affected Versions Login With Ajax versions prior to 4.5.2 Description Improper Neutralization of Input During Web Page Generation leads to a Reflected Cross-site Scripting XSS issue. This occurs when an application includes untrusted data in a web page without...

CVE-2026-82884: Improper Neutralization of Input During Web Page Generation

The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the post editor, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks that trigger when a higher privilege...

CVE-2026-84437: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the component Autocomplete Workflow. The manipulation of the argument address1 results in cross site scripting. It is possible to launch the...

PT-2026-84895

Name of the Vulnerable Software and Affected Versions Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery versions 0.0.0 through 5.0.9 Description Stored Cross-site Scripting XSS occurs because the module does not sufficiently sanitize user-supplied input, such as image alt tags, within...

PT-2026-84693

Unauthenticated Cross Site Scripting XSS in Estatik = 4.3.4 versions...

CVE-2026-83547: Improper Neutralization of Input During Web Page Generation

The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-19719: Improper Neutralization of Input During Web Page Generation

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks which are triggered when...

PT-2026-84887

Name of the Vulnerable Software and Affected Versions Drupal AI versions 0.0.0 through 1.3.13 Drupal AI versions 1.4.0 through 1.4.8 Description Stored Cross-site Scripting XSS occurs because the module does not sufficiently sanitize structured results when using legacy agent setups. This issue...

CVE-2026-83562: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in WCFM Marketplace = 3.8.2 versions...

CVE-2026-84438: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete Workflow. This manipulation of the argument firstname causes cross site scripting. The attack can be initiated remotely. The...

PT-2026-84664

Name of the Vulnerable Software and Affected Versions Spark History Server versions prior to 3.5.8 Description Insufficient XSS escaping allows a malicious Spark job to generate arbitrary unescaped frontend code. This can lead to a minimal privilege escalation within the browser. Exploitation...

CVE-2026-81775: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Estatik = 4.3.4 versions...

PT-2026-84690

Name of the Vulnerable Software and Affected Versions TrustedSite versions prior to 1.2.6 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update TrustedSite to a version...

PT-2026-84601

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser o...

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via crafted email inpu...

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via crafted email inpu...

Incorrect permission check in Appearance configuration page

Jenkins 2.421 through 2.579 both inclusive, LTS 2.426.1 through 2.568.2 both inclusive does not correctly perform permission checks in the Appearance configuration page added in Jenkins 2.421. This allows attackers with Overall/Manage permission to modify Appearance configuration options they...

RHEL 9 : golang (RHSA-2026:62405)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62405 advisory. The golang packages provide the Go programming language compiler. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Servic...

RHEL 9 : osbuild-composer (RHSA-2026:62753)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62753 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

AlmaLinux 9 : xmlrpc-c (ALSA-2026:61316)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:61316 advisory. xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component CVE-2026-15928 Tenable has extracted the preceding description block directly from the...